We compare the adversarial robustness of our model to an equivalent one that uses sigmoid activation and cross-entropy loss. This is the standard activation and loss that are widely used in neural networks today. We also compare our model to the binarized neural network [1]}, [2]}, [3]}. that also uses sign activations like our model but it has two differences. First its weights are also constrained to be binary +1 and -1, or 1 and 0 [1]}, [2]}, [3]}. Second, it is trained with gradient descent by approximating the sign activation whereas we take a direct coordinate descent approach.
